WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2, allowing remote attackers to execute arbitrary code by convincing users to visit malicious websites. This vulnerability is confirmed actively exploited (CISA KEV) in extremely sophisticated targeted attacks against specific individuals on iOS versions prior to iOS 26, per Apple's security bulletin. EPSS score of 0.12% (32nd percentile) significantly understates real-world risk given confirmed exploitation. Related vulnerability CVE-2025-14174 was issued for the same exploitation campaign, suggesting a complex attack chain targeting Apple ecosystem users.
HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access role through XML-based NETCONF configuration. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sandbox escape in Apple macOS allows a locally executing app with standard user privileges to break out of its sandbox confinement and access host system resources beyond its permitted scope. Affects macOS Sequoia prior to 15.7.4, macOS Sonoma prior to 14.8.4, and macOS Tahoe prior to 26.2, with all versions covered by CPE cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 8.8 score with Scope:Changed reflects the significant cross-boundary impact potential once a malicious app gains execution.
Gatekeeper bypass in Apple macOS allows a locally-executing app with standard user privileges to circumvent Apple's code-signing and notarization enforcement mechanism, enabling unsigned or untrusted software to run without expected security warnings or blocks. Affected versions include all macOS releases prior to Sequoia 15.7.4 and Tahoe 26.2, per Apple's security advisories. No public exploit code or active exploitation has been confirmed at time of analysis; however, the C:H/I:H/A:H CVSS impact triad reflects that successful bypass can lead to full system compromise via malicious unsigned payload execution.
Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from `.env` files when using `storybook build` command. Unpatched projects building Storybook in directories containing `.env` files risk bundling sensitive credentials into publicly viewable artifacts. Unauthenticated attackers accessing published Storybook bundles can extract secrets from source code. Runtime dev mode, CI builds using platform environment variables, and co-located applications remain unaffected. No public exploit identified at time of analysis.
Authorization bypass in GG Soft PaperWork versions 5.2.0.9427 through 6.0 allows authenticated remote attackers to access or modify resources belonging to other users by manipulating user-controlled identifiers (IDOR). The flaw was reported through Turkey's USOM/TR-CERT, and no public exploit identified at time of analysis. With an EPSS score of 0.04% (12th percentile), opportunistic mass exploitation appears unlikely, though targeted abuse within deployed environments remains realistic.